What Is eDiscovery? The Process Explained
What is eDiscovery? Short for electronic discovery, it is the process of finding, preserving, and handing over electronic evidence when a lawsuit, investigation, or regulatory inquiry is under way. If a dispute turns on what people wrote, sent, saved, or deleted, someone has to work out where that information lives, keep it from disappearing, and get it to the other side in a form they can actually use.
In the U.S., electronically stored information, usually shortened to ESI, falls under the same discovery rules as paper documents. That part is not new. What has changed is the sheer volume. A single mid-sized matter can involve millions of emails, chat messages, files, and logs spread across laptops, phones, cloud accounts, and servers, which is why most legal teams lean on specialist eDiscovery services instead of trying to manage it by hand.
What counts as ESI
More than most people expect. Email and attachments are the obvious starting point, but the list runs well past that: Slack and Teams messages, text messages, shared documents, spreadsheets, calendar entries, voicemail, database records, cloud storage, social media posts, and system logs.
Then there is metadata, the information about the information. A file’s creation date, its edit history, and the account that last opened it can matter as much as what the file says. Metadata is often what lets a team show that a document is genuine, or that it was changed after the fact.
The process, stage by stage
Firms label the stages a little differently, but the sequence is consistent. In practice it is not a straight line, and teams often loop back when a review turns up a new custodian or a data source nobody mentioned.
- Identification. Before anything is collected, the team works out who is likely to hold relevant information (the custodians), which systems they used, and what time period matters. Legal counsel usually leads, with IT filling in where the data actually sits. A scoping mistake here tends to ripple through everything after it.
- Preservation. Once a dispute is reasonably anticipated, the organization has a duty to keep what might be relevant. That normally starts with a litigation hold: a written instruction to employees and IT to stop deleting. Auto-delete settings on email and chat often have to be switched off.
- Collection. Data is gathered from phones, laptops, servers, and cloud accounts. Done properly, collection copies the data without altering it and records who handled it and when. That record is the chain of custody, and it is what protects the evidence if its authenticity is ever challenged.
- Processing. Raw data is messy. Processing converts files into a reviewable format, extracts text and metadata, strips out duplicates, and narrows the set by date range or keyword before any human reads a page.
- Review. Attorneys or reviewers go through what is left and tag it for relevance, privilege, and confidentiality. This is often the slowest and most expensive stage, which is why the earlier narrowing matters so much.
- Analysis. Alongside review, the team looks for patterns: who talked to whom, when, and what the timeline looks like. Good analysis often shapes legal strategy before a case gets anywhere near a courtroom.
- Production. The relevant, non-privileged material goes to the other side in an agreed format, usually with metadata intact and a numbering scheme so every document can be cited. Anything used at a deposition, hearing, or trial is then prepared for presentation.
How it plays out: a made-up example
Imagine a supplier suing a manufacturer over a cancelled contract. The manufacturer’s lawyers send a litigation hold the same week the demand letter arrives, covering the procurement team, two executives, and a shared drive. IT pauses the auto-delete that was wiping chat messages after 90 days.
A forensic specialist then collects email and chat from those custodians and makes a copy of one executive’s phone. Processing removes duplicates and filters by the contract period, so the pile shrinks to a fraction of its original size. Reviewers tag what is relevant, and messages with in-house counsel are held back as privileged and listed on a log. The rest is produced to the supplier’s lawyers.
This is a hypothetical, not a real matter, but the shape is familiar. Most of the value comes from the first few days, when the right people were told to keep the right data.
eDiscovery and digital forensics are different jobs
The two overlap, and a single matter can need both, but they answer different questions.
eDiscovery serves the legal process. Its job is to find relevant information at scale and deliver it in a defensible way. Digital forensics goes deeper into a smaller set of devices or accounts, asking how data was created, altered, or deleted, and it can often recover what appears to be gone. A forensic image of a phone might feed the collection stage of an eDiscovery project, and forensic analysis might later show that a key file was wiped the day before the hold went out.
If you want the forensic side in more detail, our explainer on what digital forensics is walks through it.
Where it tends to go wrong
The most common failure is also the simplest: preservation starts late. If routine deletion keeps running for a few weeks after a dispute becomes foreseeable, relevant data can vanish, and courts can impose penalties when it does.
Scope is the next trap. Cast the net too wide and review costs balloon. Cast it too narrow and you may miss a custodian or a system, then have to go back and explain why. Courts generally expect the effort to be proportionate to what is at stake, so this is a judgment call that deserves real thought.
Personal devices and messaging apps cause trouble because they sit outside the systems IT manages. Executives who text from a personal phone, or teams who moved a project into an unapproved chat tool, create data nobody planned to collect. And weak documentation, such as no record of what was collected or how, can undermine an otherwise careful process.
Who is involved
Even a modest matter draws in several groups. In-house and outside counsel make the legal calls. IT knows where data lives and how to stop it being deleted. The custodians, the people whose data is being collected, need clear instructions. Forensic and eDiscovery specialists handle collection, processing, and production, and compliance or HR teams are often pulled in when the matter involves employee conduct.
Getting ready before a dispute
Most eDiscovery pain comes from not knowing, in the first week of a dispute, where the company’s data actually is. That is far cheaper to answer in advance.
A short list goes a long way: a current map of your systems and who owns them, a retention schedule people actually follow, a litigation hold process that can start within a day, and a clear policy on messaging apps and personal devices. None of it is glamorous, but together it turns a scramble into a routine.
